diff --git a/.github/workflows/amo-signing-failsafe.yml b/.github/workflows/amo-signing-failsafe.yml
index 38b65f764..391ccdc0f 100644
--- a/.github/workflows/amo-signing-failsafe.yml
+++ b/.github/workflows/amo-signing-failsafe.yml
@@ -226,7 +226,7 @@ jobs:
 
       # --- The latest release is complete: check the update path Firefox follows.
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.release.outputs.complete == 'true'
         with:
           node-version-file: .nvmrc
@@ -286,7 +286,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         if: steps.release.outputs.complete == 'false'
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.release.outputs.complete == 'false'
         with:
           node-version-file: .nvmrc
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed2e2c540..2e65105b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,7 +103,7 @@ jobs:
       # edit a workflow). check-latest: otherwise the action takes the Node cached in
       # the runner image, which lags - 22.23.2 on 2026-09-25, two days after 22.23.3
       # was out. Every workflow here asks for the newest, as tools/linux/setup.sh does.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -154,7 +154,7 @@ jobs:
       # with the latest release; nothing reads it later. GitHub's default kept every
       # run's copy for 90 days (57 of them, 469 MB, in September 2026).
       - name: Upload extension bundles
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: faststream-bundles
           path: built/*.zip
@@ -179,7 +179,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -232,7 +232,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -352,7 +352,7 @@ jobs:
 
       - name: Upload the list of retried specs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-retried-${{ matrix.os }}-${{ matrix.suite }}-${{ matrix.shard }}
           path: logs/retried.jsonl
@@ -373,7 +373,7 @@ jobs:
       # (driverLogs.mjs keeps each attempt's) is what shows why it failed.
       - name: Upload e2e failure logs
         if: failure() || hashFiles('logs/retried.jsonl') != ''
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-logs-${{ matrix.os }}-${{ matrix.suite }}-${{ matrix.shard }}
           path: logs/
@@ -386,7 +386,7 @@ jobs:
       # deletes its log, so on most runs there is nothing here and nothing is uploaded.
       - name: Upload Firefox logs of failed attempts
         if: ${{ !cancelled() && matrix.os == 'Windows' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-moz-logs-windows-${{ matrix.suite }}-${{ matrix.shard }}
           path: logs-moz/
diff --git a/.github/workflows/firefox-beta.yml b/.github/workflows/firefox-beta.yml
index db6994fae..c3b89c4cb 100644
--- a/.github/workflows/firefox-beta.yml
+++ b/.github/workflows/firefox-beta.yml
@@ -67,7 +67,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload e2e failure logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: firefox-beta-e2e-logs-${{ matrix.os }}-${{ matrix.suite }}-${{ matrix.shard }}
           path: logs/
diff --git a/.github/workflows/firefox-stable.yml b/.github/workflows/firefox-stable.yml
index bebe663ca..7213df84c 100644
--- a/.github/workflows/firefox-stable.yml
+++ b/.github/workflows/firefox-stable.yml
@@ -90,7 +90,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload e2e failure logs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: firefox-stable-e2e-logs-${{ matrix.os }}-${{ matrix.suite }}-${{ matrix.shard }}
           path: logs/
diff --git a/.github/workflows/live-streams.yml b/.github/workflows/live-streams.yml
index 86357af44..37f3f3946 100644
--- a/.github/workflows/live-streams.yml
+++ b/.github/workflows/live-streams.yml
@@ -58,7 +58,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -82,7 +82,7 @@ jobs:
         # cancelled(): a run that timed out (a stream that never answered) is the one whose
         # logs are wanted most, and failure() skipped it.
         if: failure() || cancelled()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: live-streams-logs-${{ matrix.os }}
           path: logs/
diff --git a/.github/workflows/mutation-tests.yml b/.github/workflows/mutation-tests.yml
index 93e09dc14..0e0f9a2c9 100644
--- a/.github/workflows/mutation-tests.yml
+++ b/.github/workflows/mutation-tests.yml
@@ -48,7 +48,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
@@ -63,7 +63,7 @@ jobs:
 
       - name: Upload the mutation report
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: mutation-reports-${{ matrix.shard }}
           path: reports/mutation/
@@ -92,12 +92,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
 
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: mutation-reports-*
           path: shards
diff --git a/.github/workflows/patched-libraries.yml b/.github/workflows/patched-libraries.yml
index b05ad04bc..2fd9f1cb2 100644
--- a/.github/workflows/patched-libraries.yml
+++ b/.github/workflows/patched-libraries.yml
@@ -61,7 +61,7 @@ jobs:
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94bc7bb96..eaa730e96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -82,7 +82,7 @@ jobs:
       # workflow cannot drift from CI or from local installs.
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true
diff --git a/.github/workflows/toolchain-updates.yml b/.github/workflows/toolchain-updates.yml
index ccfe77ce1..0189e95b8 100644
--- a/.github/workflows/toolchain-updates.yml
+++ b/.github/workflows/toolchain-updates.yml
@@ -56,7 +56,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .nvmrc
           check-latest: true